Bug 1128114 - (CVE-2019-9545) VUL-1: CVE-2019-9545: poppler: denial of service via recursive function call, in JBIG2Stream:readTextRegion() located in JBIG2Stream.cc
(CVE-2019-9545)
VUL-1: CVE-2019-9545: poppler: denial of service via recursive function call,...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Peter Simons
Security Team bot
https://smash.suse.de/issue/225602/
CVSSv3:SUSE:CVE-2019-9545:3.3:(AV:L/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-03-06 09:55 UTC by Robert Frohl
Modified: 2020-06-17 06:18 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
abergmann: needinfo? (peter.simons)


Attachments
QA Reproducer (21.04 KB, application/pdf)
2019-03-06 09:57 UTC, Robert Frohl
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2019-03-06 09:55:32 UTC
CVE-2019-9545

An issue was discovered in Poppler 0.74.0. A recursive function call, in
JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by
sending a crafted pdf file to (for example) the pdfimages binary. It allows an
attacker to cause Denial of Service (Segmentation fault) or possibly have
unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9545
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-9545.html
https://gitlab.freedesktop.org/poppler/poppler/issues/731
https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadtextregion-poppler-0-74-0/
Comment 1 Robert Frohl 2019-03-06 09:57:33 UTC
Created attachment 799083 [details]
QA Reproducer

$ pdfimages -f 1 -l 1 -opw testing -upw testing RFC_POC output
[..]
Syntax Error (15173): Invalid symbol number in JBIG2 text region
-> output repeats indefinitely
Comment 2 Robert Frohl 2019-03-06 10:30:55 UTC
judging by the reproducer these codestreams are affected:
- SUSE:SLE-12:Update
- SUSE:SLE-12-SP2:Update
- SUSE:SLE-15:Update